Skip to content

tag rules creation lacks of some fields #2130

@AlexSanchez-bit

Description

@AlexSanchez-bit

Acknowledgements

Describe the bug

The Tag Rule create / edit form only exposes top-level alert fields when
building conditions, so it is impossible to write conditions against the
underlying event attributes (dataType, dataSource, action,
actionResult, severity, …). The "post event count" validator additionally
caps the field at 50, which is too low for high-volume correlation scenarios.

Regression Issue

  • Select this option if this issue appears to be a regression.

Expected Behavior

Tag rule conditions should be able to reference event-level fields under the
alert's events[] array, and the post-event count validator should accept
values up to 100.

Current Behavior

  • Event-level attributes are not present in the field selector when editing a
    tag-rule condition.
  • Entering a value greater than 50 in the post-event count field is rejected
    with a "max 50" validation error.

Reproduction Steps

  1. Navigate to Rule management → Tag Rules → Create Rule.
  2. Try to add a condition for "Event Data Type" or "Event Action" — the field
    is missing from the selector.
  3. In the same form, try to set a post-event count value above 50 — the form
    rejects it.

Possible Solution

No response

Additional Information/Context

No response

UTMStack Version

11.2.8

Operating System and version

Hypervisor and Version | Server Vendor and Model

Browser and version

Metadata

Metadata

Labels

No fields configured for Feature.

Projects

Status
👀 In review

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions